Bug-Bounty

Claude Used to Breach OpenAI Employee Account via Forum Flaw

ATLAS OWASP HIGH ▲ 8.2 Ars Technica Security Sep 19, 2026

Security researchers from Hacktron AI leveraged Anthropic's Claude to compromise an OpenAI employee's ChatGPT account through a vulnerability in OpenAI's Discourse-hosted community forum, gaining access to internal GitHub repositories. The attack chain — forum misconfiguration to internal SSO to privileged account — demonstrates how AI tooling can accelerate offensive security work against AI infrastructure. The incident also coincides with Anthropic disclosing that AI now leads 26% of its own R&D, raising broader concerns about recursive capability growth outpacing security controls.

Heap Overflow and SSO Flaw Let Hackers Access OpenAI Repos

ATLAS OWASP CRITICAL ▲ 8.5 OpenAI (via HN) Sep 18, 2026

Researchers from HacktronAI chained a heap buffer overflow in libheif (via ImageMagick on Discourse) with an OpenAI SSO misconfiguration to achieve RCE on community.openai.com, ultimately gaining access to employee ChatGPT and Codex accounts. With those compromised accounts, attackers could pivot to OpenAI's internal GitHub monorepo and connected services including Slack and email. The full exploit chain was discovered and disclosed responsibly within 72 hours, earning a $6,500 bug bounty.

Claude Opus Discovers API Flaw Enabling Ticket Fraud

ATLAS OWASP HIGH ▲ 8.2 Wired Security Jul 03, 2026

Security researcher Ian Carroll leveraged Anthropic's Claude Opus 4.7 to identify a critical vulnerability in Front Gate Tickets—a Live Nation subsidiary handling ticketing for major US festivals—that granted super-administrator access and the ability to freely issue tickets of any value. The case demonstrates LLM-assisted autonomous vulnerability discovery at scale, with Carroll noting the AI could likely have completed the full exploit chain without human intervention. Front Gate patched the flaw within 24 hours of disclosure, confirming no evidence of prior exploitation.

Claude Mythos Accelerates Automated Vulnerability Discovery

ATLAS OWASP MEDIUM ▲ 6.5 SecurityWeek Jun 10, 2026

Anthropic's Claude Mythos model is accelerating automated vulnerability discovery to a degree that may fundamentally disrupt the bug bounty and offensive security industries. As AI transitions from a force multiplier to a potential replacement for human security researchers, the economics and structure of vulnerability disclosure programs face significant pressure. The shift raises critical questions about the future of human-led offensive security and whether AI-generated findings will saturate or devalue traditional bounty programs.

Firefox Vulnerabilities Discovered via AI-Assisted Fuzzing

ATLAS OWASP HIGH ▲ 7.2 Simon Willison May 08, 2026

Mozilla used early access to Anthropic's Claude Mythos model to systematically discover and patch hundreds of previously unknown vulnerabilities in Firefox, including bugs over 15–20 years old. The effort demonstrates a step-change in AI-assisted vulnerability research, with April 2026 seeing 423 security fixes compared to a monthly baseline of 20–30. The same capability that empowered Mozilla's defenders also signals that adversaries with similar model access could industrialise exploit discovery against open-source software at scale.